OpenAI increases the reward in its Bio Bug Bounty program from $25,000 to $50,000. Universal jailbreaks are sought that bypass the biological safety locks of GPT-5.5 and GPT-5.6. The testing phase for GPT-5.5 runs until July 27, while GPT-5.6 remains in the program without a fixed end date.
Program seeks a single prompt against five locks
The Bio Bug Bounty program tests whether the protective mechanisms of GPT-5.5 and GPT-5.6 can be circumvented against dangerous biosafety-related queries with a single prompt. A universal jailbreak in this sense is a single input that bypasses all locks at once, rather than just eliciting a single response. Participants must answer five predefined questions from a clean session without moderation intervening. Only a complete, repeatable jailbreak across all five questions counts for the main prize of now $50,000. For partial successes, OpenAI awards smaller amounts at its discretion. Originally, the prize was $25,000 when the program started on April 23, 2026, and only involved GPT-5.5 in Codex Desktop. The application phase for this first program ran until June 22, after which the actual testing phase followed. Applications are submitted via a form; individuals with experience in AI red teaming, security research, or biosafety are eligible. A valid ChatGPT account and a signed non-disclosure agreement are required, as participants will have access to weakened security filters during the testing phase.
Expansion permanently includes the new model GPT-5.6
With the increase, OpenAI also extends access to GPT-5.6, which has been publicly available since July 9, 2026, and was introduced alongside the new agent ChatGPT Work. Unlike GPT-5.5, OpenAI does not specify an end date for the testing phase of GPT-5.6; the model will remain permanently included in the bounty program for now. Those already participating as testers in the GPT-5.5 bounty do not need to reapply for the expanded program; the existing approval remains valid. New applicants undergo the same vetting process as in the original program and only gain access to the testing environment with weakened protective filters after approval. According to OpenAI, the higher prize is intended to attract additional experienced security researchers, as the effort for a complete universal jailbreak increases with a new, larger model. TechRepublic also reports that security classifiers and OpenAI’s protection stack have intercepted previously verified attack attempts with high severity in pre-tests. Targeted red teaming by external experts has, however, revealed weaknesses in individual model components in some cases. No independent confirmation of this statement outside of OpenAI’s own system card is available.
External testers quickly expose vulnerabilities in other areas
How quickly qualified red teaming can break protective mechanisms is demonstrated by another independent examination. The British AI Security Institute developed a universal jailbreak against the cyber protection mechanisms of GPT-5.5 within six hours. The biosafety locks were not affected, but separate filters against malicious cyber queries were. The state-funded institute regularly tests frontier models from leading providers for security risks on behalf of the British government before and after their release and publishes its assessments independently of the manufacturers. The attack consistently generated unauthorized content in malicious cyber query scenarios through multi-stage, agentic testing. OpenAI updated the protection stack afterward; according to the institute, a final examination of the new version initially failed due to a configuration problem on the testers’ side. The finding pertains to a different security field than the Bio Bug Bounty program. However, it highlights the pressure under which OpenAI must continuously improve its protective layers. External oversight bodies like the AI Security Institute are gaining influence in the evaluation of frontier models and are making their results publicly accessible.
It will be crucial whether the doubled prize actually attracts more qualified security researchers than actors with malicious intent. The next test will occur no later than the end of the GPT-5.5 testing phase on July 27, 2026, when it will be revealed whether a complete universal jailbreak has been reported by then.
